diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0e659b1b8..d5884351e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -424,8 +424,14 @@ jobs:
 
       - name: Ad-hoc code-sign the bundle
         run: |
-          codesign --force --deep --sign - --timestamp=none OpenCADStudio.app
-          codesign --verify --strict --verbose=2 OpenCADStudio.app
+          codesign --force --sign - --timestamp=none OpenCADStudio.app/Contents/MacOS/OpenCADStudio-App
+          codesign --force --sign - --timestamp=none \
+            --entitlements crates/dwg-thumbnailer/macos/entitlements.plist \
+            OpenCADStudio.app/Contents/PlugIns/DWGThumbnail.appex
+          codesign --force --sign - --timestamp=none OpenCADStudio.app
+          codesign --verify --deep --strict --verbose=2 OpenCADStudio.app
+          codesign -d --entitlements - OpenCADStudio.app/Contents/PlugIns/DWGThumbnail.appex \
+            | python3 -c 'import plistlib, sys; assert plistlib.load(sys.stdin.buffer).get("com.apple.security.app-sandbox") is True'
 
       - name: Create .dmg
         run: |
diff --git a/crates/dwg-thumbnailer/macos/ThumbnailProvider.swift b/crates/dwg-thumbnailer/macos/ThumbnailProvider.swift
index 62065560c..f52bad1b6 100644
--- a/crates/dwg-thumbnailer/macos/ThumbnailProvider.swift
+++ b/crates/dwg-thumbnailer/macos/ThumbnailProvider.swift
@@ -39,9 +39,15 @@ final class ThumbnailProvider: QLThumbnailProvider {
             return
         }
 
-        let size = CGSize(width: cg.width, height: cg.height)
-        let reply = QLThumbnailReply(contextSize: size) { (ctx: CGContext) -> Bool in
-            ctx.draw(cg, in: CGRect(origin: .zero, size: size))
+        // Fit and center the embedded bitmap in the requested thumbnail.
+        let maxSize = request.maximumSize
+        let nativeSize = CGSize(width: cg.width, height: cg.height)
+        let scale = min(maxSize.width / nativeSize.width, maxSize.height / nativeSize.height)
+        let drawSize = CGSize(width: nativeSize.width * scale, height: nativeSize.height * scale)
+        let origin = CGPoint(x: (maxSize.width - drawSize.width) / 2, y: (maxSize.height - drawSize.height) / 2)
+
+        let reply = QLThumbnailReply(contextSize: maxSize) { (ctx: CGContext) -> Bool in
+            ctx.draw(cg, in: CGRect(origin: origin, size: drawSize))
             return true
         }
         handler(reply, nil)
diff --git a/packaging/build_macos_signed.sh b/packaging/build_macos_signed.sh
index 97ef76563..f2f937c55 100755
--- a/packaging/build_macos_signed.sh
+++ b/packaging/build_macos_signed.sh
@@ -93,8 +93,14 @@ sed "s/__VERSION__/$VERSION/g" packaging/Info.plist > "$APP/Contents/Info.plist"
 
 echo "==> codesign"
 if [ "$DEVELOPER_ID" = "-" ]; then
-    # CI-parity ad-hoc signature; cannot be notarized.
-    codesign --force --deep --sign - --timestamp=none "$APP"
+    # Sign inside out so the extension retains its sandbox entitlement.
+    # Ad-hoc signing cannot be notarized.
+    codesign --force --sign - --timestamp=none \
+        "$APP/Contents/MacOS/OpenCADStudio-App"
+    codesign --force --sign - --timestamp=none \
+        --entitlements crates/dwg-thumbnailer/macos/entitlements.plist \
+        "$APP/Contents/PlugIns/DWGThumbnail.appex"
+    codesign --force --sign - --timestamp=none "$APP"
 else
     # Sign nested code before the outer bundle. The sandbox entitlement is
     # required for the QuickLook extension. Use hardened runtime
@@ -107,7 +113,9 @@ else
     codesign --force --timestamp --options runtime \
         -s "$DEVELOPER_ID" "$APP"
 fi
-codesign --verify --strict --verbose=2 "$APP"
+codesign --verify --deep --strict --verbose=2 "$APP"
+codesign -d --entitlements - "$APP/Contents/PlugIns/DWGThumbnail.appex" \
+    | python3 -c 'import plistlib, sys; assert plistlib.load(sys.stdin.buffer).get("com.apple.security.app-sandbox") is True'
 
 echo "==> dmg"
 DMG="$DIST/OpenCADStudio-v$VERSION-macos-arm64.dmg"